UK's huge SME sector especially vulnerable to cyber-attacks

• SME's employ 60 per cent of the British workforce
• Most small companies are sitting ducks with no strategy or systems in place to protect them
• Attacks up by 31 per cent in a year. 20 per cent of SMEs hit six times or more
• New research and report from Vodafone calls for urgent government action

Back at the beginning of the 19th Century, legend has it that in the full fig of his pomp, circumstance and propensity to invade countries as far away as Russia, the French Emperor Napoleon disparagingly dismissed the British as "a nation of shopkeepers." The Brits raised their eyebrows, took it as a back-handed compliment and continued in their established habit of retailing anything and everything to everyone in the country. A few years later, at Waterloo, they brought Boney's career as would-be world king to a definitive and inglorious conclusion. After that he couldn't even aspire to be squire of St Helena and so died from an attack of poisoned wallpaper.

Waterloo was in 1815 but 206 years later some things in the UK haven't changed that much. According to the influential organisation, the Federation of Small Businesses, 99.9 per cent of the UK's six million-strong private sector businesses is comprised of small and medium-sized enterprises, (SMEs) and they employ over 60 per cent of country's workforce.

This morning, Vodafone has taken up the cudgels in support of the sector and has published a new strategic report, "Protecting our SMEs, cyber-security in the new world of work." Written in light of and during the time of the global pandemic, the report  says the UK’s economic recovery from Covid-19 will be compromised and significantly delayed unless new policy recommendations are introduced to take account of the rising tide of cyber-attacks that become more and more apparent over the past year.

Even before the the current crisis struck, SMEs had been subject to increasing surges of cyber-attacks due, mainly to the absence of cyber-security resources and solutions to prevent such incursions. Indeed, a report issued shortly before the Covid-19 outbreak found that, globally, over 40 per cent of all cyber attacks were on SMEs and the average loss per attack was US$ 188,000. What's more, having identified SMEs as the weakest link in a long commercial chain, they were used in very sophisticated attacks to piggy-back on and exploit their connections to bigger organisations higher up the supply chain.

Even in pre-Covid-19 days cyber-attacks cost the UK economy £34 billion a year and, as the Vodafone research stresses, 31 per cent of UK SMEs have reported an increase attacks which began at the time of the first national lockdown in March 2020. It seems likely and probably inevitable that, a year on, the rate, will now be even higher, especially considering that so many employees of so many SMEs (75 per cent of them) are now working remotely and are in need of greatly improved cybersecurity.

Vodafone's report stresses that the SME sector is so important to the UK's macro-economy that it needs and deserves direct government support in the form of a cyber-security policy designed specifically to protect and help it. Among a raft of recommendations, the report calls for an immediate  reduced Value Added Tax (VAT) rate to be introduced on cybersecurity products, and for extra investment and resources to be ploughed into the National Cyber Security Centre so that it can beef-up its cybersecurity for small businesses capabilities.

What's more, the government should provide a further five per cent to the National Cyber Security Strategy budget fund provision of local cybersecurity skills and training while the enhanced and re-focused national R&D budget should go towards the development of cybersecurity products and to the enlargement of research centres in the North and Midlands.

Sobering statistics

The figures are bleak and should serve to concentrate the government's mind. The report shows that 41 per cent of of SMEs have suffered cyber-attacks and 20 per cent had experienced multiple attacks (six or more times) over the past 12 months. It is estimated that 1.3 million UK SMEs would fail and collapse completely after falling victim to a cyber-attack.

The average cost of an attack on an SME is calculated to be £3,230 and 23 per cent of they acknowledge that they would be unable to survive such a loss and would have to close completely. A further 16 per cent say they might just about stay in business on a reduced basis but would have to shed staff while 22 per cent say an attack would either wipe out their dwindling financial reserves or leave them in a parlous financial position.

Commenting on the publication of the report, Anne Sheehan, Business Director at Vodafone UK said: "Cyberattacks are an existential threat to Britain’s small businesses, yet nearly a third have no cybersecurity strategy in place. This report’s stark findings are a warning that as SMEs do more and more of their business online, it is vital that they take the steps they need to keep themselves safe  - and that Government does more to support them to do so. The UK needs successful, resilient small businesses."

Simon Fell, the MP for the constituency of Barrow-in-Furness in north-west Englan and Chair of the All-Party Parliamentary Group on Cybersecurity, said, "This new report from Vodafone shows that businesses often lack awareness of the cybersecurity risks they face, the protection they need to mitigate them, and the resources to withstand them. SME cybersecurity is not a prosaic issue facing a few journeymen trying their hands at a new business during the pandemic, but rather an issue of national economic resilience."

You can read the Vodafone report in full here